fix: set minimal top-level permissions on workflows (#14358)

- Fix CodeQL alerts by declaring read-only GITHUB_TOKEN scope at the workflow level. The codespace image publish workflow additionally needs packages: write to push to ghcr.io.
2026-05-04 17:56:25 +05:30
parent ea87610999
commit 2dee7457cd
9 changed files with 28 additions and 0 deletions
@@ -3,6 +3,10 @@ name: Publish Codespace Base Image
 on:
  workflow_dispatch:

+permissions:
+  contents: read
+  packages: write
+
 jobs:
  publish-code-space-image:
    runs-on: ubuntu-latest